Security News
The Risks of Misguided Research in Supply Chain Security
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
als-require
Advanced tools
als-require
is a lightweight utility that enables the importation and modification of CommonJS modules before execution in both browser and Node.js environments.
Capabilities of als-require
:
To install als-require
, use npm:
npm install als-require
Import in nodejs:
const Require = require('als-require')
const module = Require.getModule('./some/path')
Import in browser:
<script src="/node_modules/als-require/require.js"></script>
or
<script src="/node_modules/als-require/require.min.js"></script>
<script>
Require.version = '1.0'; // optional - adding version when fetching files
Require.cyclicDependencies = true // false by default
Require.logger = console // console by default
Require.getModule('./some/path')
.then(module => {/* code */})
// or
require('./some/path')
.then(module => {/* code */})
</script>
als-require
has two files for NodeJS and browser which has same structure and api.
Each file includes Require
class with folowing structure:
class Require {
static getModule(path, context) {}
static contents = {}
static cyclicDependencies = false // allow cyclic dependencies
static logger = console // logger for logger.warn
static bundleName = 'renderedBundle'; // variable name for bundle
static contextName = 'context';
static minified = false
constructor(path) {
this.contents = {}
this.path = path
this.fullPath
this.contentReady = false
}
// returns promise in browser
getContent() {}
// returns result
build(context = {}, scriptBefore, scriptAfter, modules = {}) {}
// only in nodejs version. returns bundle
bundle(context = {}, scriptBefore, scriptAfter) {}
}
const require = Require.getModule // in browser
The structure above describes only properties and methods for usage, without additional properties and methods which used as private methods.
Arguments:
path
(String): relative path to module for requirecontext
(Object): shared object which will be available in all modulesHere explanation what each method and property used for:
Require.contextName
(String): Name for context variable (default context)
Require.getModule
- quick way to get contents and build them in one step
contents
, modules
and result
Require.contents
- includes modules contents and their children list and used as cache
require.getContent()
- used for reading module file's contents
Require.contents
and to require.contents
async
and NodeJS version is sync
require.build(modules,context,contextName)
- builds all modules results
Require.minified
: minify the bundle (default false)
Require.bundleName
: defines variable and assigns bundle result to it
Require.bundleName
not defined or equals to '', no assignmentbundle
- returns bundle inside (function() {})()
scriptBefore
- Additional script to execute before bundle created (default '')scriptAfter
- Additional script to execute after bundle created (default '')
context
, modules
and result
after creation, but before returning the resultcontext
- The context for build in bundle (default empty object)const Require = require('als-require')
const mod = new Require('./relative/path/to/module')
mod.getContent() // reading all modules
for(const path in mod.contents) {
mod.contents[path] = mod.contents[path] // modify if needed
}
const context = {} // shared object for all modules empty object by default
const modules = {} // will include all module`s results {relativePath:moduleResult,...}
const scriptBefore = "const SomeVariableAvailableForAllModules = 'Hello';"
const scriptAfter = "console.log('All done!');"
const result = mod.build(context,scriptBefore,scriptAfter,modules) // build the result
const bundle = mod.build(context,scriptBefore,scriptAfter,modules) // build the bundle
<script src="/node_modules/als-require/require.js"></script>
<script>
const mod = new Require('./relative/path/to/module')
const promise = mod.getContent() // fetching all modules
promise.then(mod => {
for(const path in mod.contents) {
mod.contents[path] = mod.contents[path] // modify if needed
}
const modules={}, context = {};
const scriptBefore = "const SomeVariableAvailableForAllModules = 'Hello';"
const scriptAfter = "console.log('All done!');"
const result = mod.build(context,scriptBefore,scriptAfter,modules) // build the result
})
</script>
In case of path which not starts with .
, Require will look for file in node_modules (by checking in package.json).
If such package not found (for example require('fs')
), result for this package will return null
.
const somePackage = require('some-package');
const somePackage1 = require('./node_modules/some-package/index.js');
const fs = require('fs');
module.exports = {somePackage,somePackage1,fs}
In case above somePackage
and somePackage1
should return the package, but fs, should return null.
Pay attention, using './node_modules/some-package/index.js'
instead 'some-package'
, you save extra request/readFile for looking the filename.
The context
object is a shared space accessible by all modules loaded by als-require
. This allows modules to read and write shared data, enabling more interactive and dynamic module behaviors.
Make sure you are using the context
for static value (like constants and common variables and functions) and not dynamic, cause it available to all require's results.
FAQs
A utility for using CommonJS require in the browser and creating bundles.
We found that als-require demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
Snyk's use of malicious npm packages for research raises ethical concerns, highlighting risks in public deployment, data exfiltration, and unauthorized testing.
Research
Security News
Socket researchers found several malicious npm packages typosquatting Chalk and Chokidar, targeting Node.js developers with kill switches and data theft.
Security News
pnpm 10 blocks lifecycle scripts by default to improve security, addressing supply chain attack risks but sparking debate over compatibility and workflow changes.